[field validation] Check event.type values are aligned with event.category

[andrewkroh]

The event.type values are constrained based on the event.category values. Each category value has an expected list of event.type values that can be used. ECS lists these values expected_event_types in ecs_flat.yml ¹.

As a package developer I would like elastic-package to validate the event.category and event.type combinations used events to ensure they are allowed by ECS.

Related

• Field validator should check for ECS fields marked as arrays #615
• fix ECS schema on system/auth package integrations#3424 (comment)

Footnotes

1. https://github.com/elastic/ecs/blob/b2df3bc395e125b9380a25e009eddef1b1890476/generated/ecs/ecs_flat.yml#L2645-L2648 ↩

[jsoriano]

Putting this also on hold till we have something like elastic/package-spec#313.